hxxps://iconicone[.]online/ups/es

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 20:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://iconicone.online/ups/es

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2600	msedge.exe
2600	msedge.exe
3524	msedge.exe
3524	msedge.exe
932	identity_helper.exe
932	identity_helper.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 2876	3524	msedge.exe	85
PID 3524 wrote to memory of 2876	3524	msedge.exe	85
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 1992	3524	msedge.exe	86
PID 3524 wrote to memory of 2600	3524	msedge.exe	87
PID 3524 wrote to memory of 2600	3524	msedge.exe	87
PID 3524 wrote to memory of 2252	3524	msedge.exe	88
PID 3524 wrote to memory of 2252	3524	msedge.exe	88
PID 3524 wrote to memory of 2252	3524	msedge.exe	88
PID 3524 wrote to memory of 2252	3524	msedge.exe	88
PID 3524 wrote to memory of 2252	3524	msedge.exe	88
PID 3524 wrote to memory of 2252	3524	msedge.exe	88
PID 3524 wrote to memory of 2252	3524	msedge.exe	88
PID 3524 wrote to memory of 2252	3524	msedge.exe	88
PID 3524 wrote to memory of 2252	3524	msedge.exe	88
PID 3524 wrote to memory of 2252	3524	msedge.exe	88
PID 3524 wrote to memory of 2252	3524	msedge.exe	88
PID 3524 wrote to memory of 2252	3524	msedge.exe	88
PID 3524 wrote to memory of 2252	3524	msedge.exe	88
PID 3524 wrote to memory of 2252	3524	msedge.exe	88
PID 3524 wrote to memory of 2252	3524	msedge.exe	88
PID 3524 wrote to memory of 2252	3524	msedge.exe	88
PID 3524 wrote to memory of 2252	3524	msedge.exe	88
PID 3524 wrote to memory of 2252	3524	msedge.exe	88
PID 3524 wrote to memory of 2252	3524	msedge.exe	88
PID 3524 wrote to memory of 2252	3524	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iconicone.online/ups/es
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffc5b1c46f8,0x7ffc5b1c4708,0x7ffc5b1c4718
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,1010285517155705375,6181102996237694894,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,1010285517155705375,6181102996237694894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,1010285517155705375,6181102996237694894,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1010285517155705375,6181102996237694894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1010285517155705375,6181102996237694894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1010285517155705375,6181102996237694894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1010285517155705375,6181102996237694894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1010285517155705375,6181102996237694894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,1010285517155705375,6181102996237694894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,1010285517155705375,6181102996237694894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1010285517155705375,6181102996237694894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1010285517155705375,6181102996237694894,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1010285517155705375,6181102996237694894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1010285517155705375,6181102996237694894,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,1010285517155705375,6181102996237694894,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5920 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
acc541cf37238f878d6084680e8780f4

SHA1
2c3083a501572ca08f6f7d9f7f0665bffb250073

SHA256
e741bdadefb7354eaf3120560cd39fd3a92dd701b42f5ea7147f690a256c1b2c

SHA512
12f88fda37f973313ed10afa3c765e5ff0c8ba27b422bb46cd76dd2f5335335d97a5f951247b60ef8a150bde6edaa98529848aefdb7fb618bd4c94f41b4705ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
914B

MD5
42d70df67a0e39ba0b3c0f9c686643a7

SHA1
c081bb508707f95905ee3dca1b59bf37c5eb83de

SHA256
b0762896df691c6ca7723d2e577deee642b14b9e5f6d77b35dca6819319307a2

SHA512
277413fb704ce57997e1122b31c205a6c0f472b0afd4aea97d3306208ffbadacb1354f47a5d06d1be953eef034f1106c97000986c15651c68e3de80203a65050

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f37b221b70c924a3a8cbf626d373b02f

SHA1
1cafdf8ab60397d9496a4c2362c2b5cb37d500f1

SHA256
38b03d8fa0b24524997ce7623d91cefd6eb0a456d944dac964075dad90fe5bdf

SHA512
40a88c77222898c67adeeb0a08b7ace40b2174853bd58a1c8490b05fd95235084fe83d7a5c5a564ae34c33d205652298bc22b2a0bf90e1a733d27d3476a23fa2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
13e00fc30286ccf3815c2203fe73a15f

SHA1
4eddc0b219b215922874e8edb237ce5eb21cc1ad

SHA256
bd909d3beb4a5f7a4c9a40864a4985e3c604267519d49c65f678a04b570a106f

SHA512
db44e6a0605334a5c3f143c54469f22c75c081c75219e51e774633d7721939c5687fd4a596946a60987f9d3156397bdba42f086517bad2e8071245826ca12205

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
92853418e4c41e58c005cfc190bd104c

SHA1
2e65455e4e6a5a109b0308654b8dc2c2b87a72f6

SHA256
aa157a658fd903a73f141c7feaf4be64495da1c7e25a9530f0b23aeaf755dae6

SHA512
169b7ae42a14ec325c3b6a260bf4d7e278f2ab436063cba8775cc4d4a1be16f22eff442add0adf7c08db74850294c325d741042f430f21f30913f1019aeccb23

Download Submit